ac0f742b2b137943f549c689a3ec9e6e1c92cab20b5ab971832b3d6dac97eb17

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
Size 24.5MB
Sample260828-pmqkcsch39
SHA256 ac0f742b2b137943f549c689a3ec9e6e1c92cab20b5ab971832b3d6dac97eb17
MD5 8c93f0a7f0603957928ea9aad3b76c55
SHA1 5eddb85d6bebc35f9d21bd38094825ba8bae22af
SHA512 d42a4760aa05dca11c90f8ddae064c41382e9bee0c788a88359b8c2dce23160042913301a9bdfedd01690ec9a960dd9aa2196b92f62443bfbbdcdb7652d3cfb1
SSDEEP 49152:zudCDvwT4vKKbhWj0wjlktD4a0CfZ1Cy988xJhGnSDJEKHMvtrI72dRt8rfIkat7:pvKKbh6Jta+UUamsrfszizYP1b
TLSH
T119476216B746898BE42A9634844B4FE4E325DCB186B0837733B9371D2FFE34C5EA6215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lEHaMT.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\WJ7UqX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Custom signature

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/5000-693-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Custom signature

Detects executables containing artifacts associated with disabling Widnows Defender 3 IoCs

resource	yara_rule
behavioral1/memory/5000-677-0x0000000003910000-0x0000000004113000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5000-681-0x0000000003910000-0x0000000004113000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5000-715-0x0000000003910000-0x0000000004113000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	xbNUjm.exe

Executes dropped EXE 3 IoCs

pid	Process
4420	xbNUjm.exe
2408	xbNUjm.exe
5000	lEHaMT.exe

Loads dropped DLL 3 IoCs

pid	Process
4420	xbNUjm.exe
2408	xbNUjm.exe
5000	lEHaMT.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1268	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\WJ7UqX\\xbNUjm.exe\""	xbNUjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\lEHaMT\\lEHaMT.exe\""	lEHaMT.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
448	cmd.exe
1548	cmd.exe
1480	cmd.exe
452	cmd.exe
4548	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	xbNUjm.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\lEHaMT\lEHaMT.exe	xbNUjm.exe
File created	C:\Program Files (x86)\lEHaMT\XPSPLOG.dll	xbNUjm.exe
File created	C:\Program Files (x86)\lEHaMT\image.png	xbNUjm.exe
File created	C:\Program Files (x86)\lEHaMT\thumbs.db	xbNUjm.exe
File opened for modification	C:\Program Files (x86)\lEHaMT\lEHaMT.exe	xbNUjm.exe
File opened for modification	C:\Program Files (x86)\lEHaMT\XPSPLOG.dll	xbNUjm.exe
File opened for modification	C:\Program Files (x86)\lEHaMT\thumbs.db	xbNUjm.exe
File opened for modification	C:\Program Files (x86)\lEHaMT	xbNUjm.exe
File opened for modification	C:\Program Files (x86)\lEHaMT\image.png	xbNUjm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3832	cmd.exe
1124	cmd.exe
5144	cmd.exe
4312	cmd.exe
4152	cmd.exe
552	cmd.exe
216	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lEHaMT.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xbNUjm.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4400	schtasks.exe
3892	schtasks.exe
5168	schtasks.exe
3824	schtasks.exe
3236	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
556	2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe
4420	xbNUjm.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4548	4420	xbNUjm.exe	103
PID 4548 wrote to memory of 3824	4548	cmd.exe	106
PID 4420 wrote to memory of 448	4420	xbNUjm.exe	107
PID 4548 wrote to memory of 3544	4548	cmd.exe	110
PID 448 wrote to memory of 3236	448	cmd.exe	112
PID 4420 wrote to memory of 1548	4420	xbNUjm.exe	115
PID 4548 wrote to memory of 1088	4548	cmd.exe	117
PID 1548 wrote to memory of 4400	1548	cmd.exe	118
PID 448 wrote to memory of 208	448	cmd.exe	119
PID 1548 wrote to memory of 632	1548	cmd.exe	121
PID 448 wrote to memory of 4616	448	cmd.exe	122
PID 1548 wrote to memory of 2536	1548	cmd.exe	123
PID 4420 wrote to memory of 1480	4420	xbNUjm.exe	124
PID 3832 wrote to memory of 4840	3832	cmd.exe	127
PID 1480 wrote to memory of 3892	1480	cmd.exe	128
PID 4420 wrote to memory of 452	4420	xbNUjm.exe	130
PID 1480 wrote to memory of 4752	1480	cmd.exe	132
PID 1124 wrote to memory of 4456	1124	cmd.exe	129
PID 452 wrote to memory of 5168	452	cmd.exe	135
PID 1480 wrote to memory of 5184	1480	cmd.exe	136
PID 452 wrote to memory of 5200	452	cmd.exe	137
PID 452 wrote to memory of 5216	452	cmd.exe	138
PID 5144 wrote to memory of 5264	5144	cmd.exe	139
PID 4420 wrote to memory of 5000	4420	xbNUjm.exe	142
PID 5000 wrote to memory of 4312	5000	lEHaMT.exe	146
PID 5000 wrote to memory of 4152	5000	lEHaMT.exe	145

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lEHaMT.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_8c93f0a7f0603957928ea9aad3b76c55_coinminer_glassworm_icedid_njrat_poet-rat_remcos.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:556

C:\Users\Public\WJ7UqX\xbNUjm.exe
C:\Users\Public\WJ7UqX\xbNUjm.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WJ7UqX\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\WJ7UqX\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:448
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5168
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5216
- C:\Program Files (x86)\lEHaMT\lEHaMT.exe
  "C:\Program Files (x86)\lEHaMT\lEHaMT.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\lEHaMT" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4312
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\lEHaMT" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\lEHaMT" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:216

C:\Users\Public\WJ7UqX\xbNUjm.exe
"C:\Users\Public\WJ7UqX\xbNUjm.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WJ7UqX" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\WJ7UqX" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4840

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2028

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1124
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4456

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5264

C:\Program Files (x86)\lEHaMT\lEHaMT.exe
"C:\Program Files (x86)\lEHaMT\lEHaMT.exe"
1⤵
PID:3340

C:\Program Files (x86)\brQqtN\It1j1H8P.exe
"C:\Program Files (x86)\brQqtN\It1j1H8P.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\brQqtN\XPSPLOG.dll
Size 64KB
SHA256 00155ee07966bae7f7c35277748e1ecd36d6a703ed7fe1622fa0482dcf8d832e
MD5 a9d66300e1b843ec041032fb97359ca7
SHA1 ab0b76ca8c6aa5166ea8882781b0303ab1ceaf2f
SHA512 da881a9600edc156b394acfc1fd960ac530a5e7e805eb61cbe8fc4b72bb7ce21be425e31a6d11b1b9c18c9124546cf0b0425470246d42923f70fd66eea84e868
SSDEEP 1536:o2gRD26twkyYSle/qhRZi/IaefvxLhHOdX0D15tCXfR4p:VuDVfyYAkejiAJphPDdCp2
TLSH
T1F653012AC2DE0E2EF149787A1D0CDA5EBA7B3560512B0D45D8BAB494DC74B84307DBCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\lEHaMT\XPSPLOG.dll
Size 4.6MB
SHA256 7995ecf360be1fea8eadf6006ea4fde8e2326555343b52f1c848e1da3218fe82
MD5 dcee41832d69979cf65bceb65f54fdd2
SHA1 edf55169ac317559ee10e211c710605fd2fe4f8d
SHA512 45176c9ddd55c7738b9b9257f48b751b8caf9e153bec7bdd766448d793d0486c71c90470e5848bb3f75223652150e249ae855b0e82aad85fb5375495ab34f6d0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyi:BMWKfU+BcUTHCCCfqCiUffni
TLSH
T106263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\lEHaMT\XPSPLOG.dll
Size 2.3MB
SHA256 95b466ec6d902d93e0abce1fa1511c6382a854bc28ed8d29ec5085060dd58d27
MD5 9e874b8dff9acfa45eb8a4ad55f9fb13
SHA1 ae8210e1f3d3cf05d4021ec70fb91e1b5418d7ca
SHA512 17c7462dcb0c581b5a2b449d3e472a2ab86ad3e11823c6c4f19e856ab87bfdbee9466eaf1c90244ba46c26624b6284a0cf73edcb57627e8146e7780f46904d7f
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nED:yCMWmcKfST5t+BceThTz
TLSH
T1EEB5339BF59B461EEA6133792F8DEC9D72FD49C8822DE548D4E2704F4010B6E903E68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\lEHaMT\image.png
Size 5.0MB
SHA256 9dfde49ae28f26987d75768c48aba9bf585dfd6010002b4dc8a9b1ccb03f6d75
MD5 3821b0369c81829cd181b881d314c4f2
SHA1 260cb0148296b765b8375ff698a42ca53766c566
SHA512 f1de37660aff67459f217b9d860ed22f144e39db0d96ee2c5bcef45a7e656e2198dd638ab7c1c851cd37633fafb881415b3c937f46e26c3fb1697b5809cac35a
SSDEEP 98304:OFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:DRIUjDgAk+jkn/IXhVaK
TLSH
T14B3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lEHaMT.exe

Path C:\Program Files (x86)\lEHaMT\lEHaMT.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\lEHaMT\thumbs.db
Size 358KB
SHA256 6183ff99022c886db0d6f3dd05a498aeaf6531b16c087e4ca16bc0733aa876b9
MD5 d1de1e12d1d425a66db78448040c80ee
SHA1 7703ff27aa0753db1dc5331f5bb4b260a8430daa
SHA512 eaf9229e32da21d1deec741cfdf6700ee7f8ecf4ee56ab4e8e7a8698308127f8eaf63f88c36b98f9636dd9793161f71520492deb500c8004ac5ca9147822c445
SSDEEP 6144:fiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:K8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T15774F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 ba3c702b24e4ef16c111bf92823170f6e81fd37fbafaccbeef52192a1c094380
MD5 739edcc2c973b7a990767601fa661f21
SHA1 6f8df82dc929f3c40e2403252d9c7ec09001dbb6
SHA512 098608f58ab3fc68088ace47a30c15056d274aada2893a224c29ddc0cc70f82b4ca723ce487ded1306f839ac12ee8782bc6383817fd77e7cde3dea99525731d1
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\WJ7UqX\UxEnhance64.dll
Size 3.1MB
SHA256 56fb175575c8dced95e9985a175c0d432bdc2d130a9581cd3181fc9c4114f9e0
MD5 7902ecb9b1f84d8948b1c7f56d9212eb
SHA1 8aa63e6d0c6760f4bff4d2f0b5c3f11026034f82
SHA512 b1a3f91b696d2aa120b12a4f41ad90f78d33a225c9baa38fa805dd9093bba00d3e7d39ae688e5462564b47ad2fdd9330b3a16ca47a8a9b603d170f544d9bf816
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+y:P9m29xx3Tiqt06ox6+z2rNNrKoy
TLSH
T1BFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\WJ7UqX\adoresd.dat
Size 4.7MB
SHA256 99ed7894e1586fca6c0a5be31cfd6a9093712869b230d86c0b3a0319bb253746
MD5 642f169e2c197961548b7451fc511941
SHA1 1fda051b64e63750484fa8d908a2697739082d0d
SHA512 939a7444decdf806c1d0f001ff292424d27fa5ec67e20c9e88e99fe4bb4251b55b2e31bbbb7eafe988b82898cabbfd07d6fbb1764660a7278428d469d9b81fef
SSDEEP 98304:/KC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:/KClqhi0Cv54K2IVS0VQg
TLSH
T1843633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\WJ7UqX\msadox.tb
Size 8KB
SHA256 e689e3759ed8fc08a20125f2a828ff2df3569c2e23dd4d4f89cbd4c2f78e8fa2
MD5 fd5c0f111415f3937924ef6915b48a56
SHA1 f48122c9f0243f89642b0f13b4d6519466774947
SHA512 0531252c7358e52dbe43de674e540f9ae40078e52bd3d36831a4a34d151978e021878aa997462b8e3a863ccbff4fb1d304520a4906c43c9dabd2be28e7bb632c
SSDEEP 192:RqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:RsZqZOXQ3uqvR2Kfzp
TLSH
T13A029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xbNUjm.exe

Path C:\Users\Public\WJ7UqX\xbNUjm.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/556-524-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/556-525-0x00007FF857780000-0x00007FF857790000-memory.dmp

Download

memory/556-504-0x00007FF857780000-0x00007FF857790000-memory.dmp

Download

memory/556-2-0x00000000005D0000-0x00000000005DC000-memory.dmp

Download

memory/556-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/2408-578-0x00007FF866220000-0x00007FF866222000-memory.dmp

Download

memory/2408-589-0x00007FF866210000-0x00007FF866212000-memory.dmp

Download

memory/2408-588-0x0000021A4EBE0000-0x0000021A4F467000-memory.dmp

Download

memory/2408-587-0x0000021A4EBE0000-0x0000021A4F467000-memory.dmp

Download

memory/2408-586-0x0000021A4EBE0000-0x0000021A4F467000-memory.dmp

Download

memory/2408-585-0x0000021A4EBE0000-0x0000021A4F467000-memory.dmp

Download

memory/2408-579-0x0000021A4EBE0000-0x0000021A4F467000-memory.dmp

Download

memory/2408-570-0x00007FF848C60000-0x00007FF84917E000-memory.dmp

Download

memory/2408-573-0x0000021A4EBE0000-0x0000021A4F467000-memory.dmp

Download

memory/4420-556-0x000001EC89140000-0x000001EC891CA000-memory.dmp

Download

memory/4420-544-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-565-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-563-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-557-0x000001EC89140000-0x000001EC891CA000-memory.dmp

Download

memory/4420-558-0x000001EC89140000-0x000001EC891CA000-memory.dmp

Download

memory/4420-559-0x000001EC89140000-0x000001EC891CA000-memory.dmp

Download

memory/4420-550-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-546-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-597-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-538-0x00007FF866220000-0x00007FF866222000-memory.dmp

Download

memory/4420-543-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-530-0x00007FF866210000-0x00007FF866212000-memory.dmp

Download

memory/4420-531-0x00007FF848C60000-0x00007FF84917E000-memory.dmp

Download

memory/4420-545-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-536-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-539-0x000001EC88470000-0x000001EC88CF7000-memory.dmp

Download

memory/4420-555-0x000001EC88D00000-0x000001EC88D4E000-memory.dmp

Download

memory/5000-681-0x0000000003910000-0x0000000004113000-memory.dmp

Download

memory/5000-677-0x0000000003910000-0x0000000004113000-memory.dmp

Download

memory/5000-676-0x00000000015E0000-0x00000000015E1000-memory.dmp

Download

memory/5000-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5000-696-0x0000000005A20000-0x0000000005A34000-memory.dmp

Download

memory/5000-674-0x0000000003910000-0x0000000004113000-memory.dmp

Download

memory/5000-715-0x0000000003910000-0x0000000004113000-memory.dmp

Download

memory/5000-670-0x0000000074B70000-0x00000000752BA000-memory.dmp

Download

memory/5000-669-0x00000000015C0000-0x00000000015C1000-memory.dmp

Download